Tag Info

New answers tagged

1

rsyslogd is not configured to break lines like that. It's possible to use log format templates but I'm not sure they allow lines to be broken like that. This is most likely what the application is sending to rsyslogd. You can try to capture the communication on port and check what is being sent (tcpdump -s 0 -A port 514). Another test is to use logger to ...


1

Yes, templates is a standard and recommended way to generate dynamic file names in rsyslog. They allow you to logically separate the file name format from the action and introduce clear structure to your config. Regarding TCP, Jenny D already gave you correct answer. Please note that your hosts need to support syslog over TCP. Syslog was initially based on ...


0

From the manual page: To forward messages to another host via UDP, prepend the hostname with the at sign ("@"). To forward it via plain tcp, prepend two at signs ("@@"). So change your config line like so: kern.* @@loghost and tell rsyslog to reread the config file.


0

First thing that comes to mind is to have all your devices log to a syslog-server and have it store the logs in databases. One database for firewall logs(lets call it firewall_logs), one for the rest (other_logs). Have splunk pull the logs from other_logs using a user that does not have access to firewall_logs and have the managed service pull the logs from ...


6

This appears to be a bug in nc. The nc command uses the poll system call to wait until input is received from either stdin or the socket. When a UDP packet has been send to a closed UDP port on the receiving end, an error message is send back. The poll call will return this status to the nc command, but nc does not actually process the error. Instead nc ...



Top 50 recent answers are included